1 · Brief overview

Before we start, an important disclaimer, this work is for educational purposes only and may have inaccurate or wrong information. This is not an official audit but just a review from a random guy, the official audits exist and should be referenced in case someone want to go deeper into the proofs. The audience is therefore the folks that heard about the basic cryptographic operations and know what the basic elliptic-curve operations mean (or not if you just want to stay in this page). It is not intended to formally demonstrate anything but instead give a practical explanation how things relate to others. So hopefully this work will bring more visibility to the great work of the Monero developers, specially, in this case, to the FCMP++ developers.

The task to explain FCMP++ (Full Chain Membership Proofs + Spend Authorization + Linkability) is quite challenging so let's first start breaking down this acronym and understand what we are doing:

• Full Chain - we are going to use all outputs ever created in our proof somehow
• Membership - the output (enote) we are spending is actually a member of a set. In this case the Full Chain.
• Proofs - we are providing a mathematical proof that any verifier could be convinced that the enote being spent is on chain and the prover knows the openings (secret keys) of that enote (output)
• Spend Authorization - we are actually the owner of the enote (output) that we are proving that we are spending from
• Linkability - the one enote (output) that we are spending from has just one key-image and we are providing a proof that this key-image is the correct (and unique) one so nobody can spend again that enote (output) and nobody knows which one was that.

Alright, so how do we start and what is the path we are going to take to understand the whole proof? To answer those questions in a non technical way, let's see what the prover and verifier are doing:

The prover

1. Create a SAL (Spend Authorization and Linkability) proof. This proves that the prover owns a specific output (enote) and the key-image related to it is well formed. But it doesn't prove that the enote is on chain. The prover could have done the SAL proof on an invented enote.
2. Create the membership proof.
1. Since the enotes are organized in a tree format, the prover shows that he knows the path up to his owned enote.
2. He also proves that he knows the openings (the secret keys) of that enote (actually the tuple $(O,I,C)$, the enote (output), the hash-to-point function (which is used to form the key-image) and the amount commitment)
3. He also proves that his enote (output) is a member of the tree by means of a "circuit".
4. Finally he combines all these information in one equation called the Generalized Bulletproofs (GBP), which makes the proofs short and fast.
3. Provide the proofs.

The verifier

1. Verify the SAL (Spend Authorization and Linkability) proof. So he is convinced that the prover owns (he knows the secret keys) of the enote they are talking about. Moreover he gets convinced that the key-image (which is public) is well-formed from that enote.
2. Verify the membership proof from the Generalized Bulletproofs (GBP), he gets convinced that the tuple $(O,I,C)$ is a member of the tree but he doesn't know which one.

Why there is no inflation happening?

1. The prover can only spend an enote he owns. Verified by SAL proof.
2. The prover can only spend an enote that is on chain. Verified by membership proof.
3. The prover commits to a new amount and the inputs and outputs balance $\sum C_{\text{in}}=\sum C_{\text{out}}+\text{fee}·H$. Every amount is positive and between $[0,2^{64})$. Like before FCMP++. Nothing changes
4. The key-image really comes from the spending enote and never appeared on chain before. (Independently verified by every node by looking at the key-images database). Like before FCMP++. Nothing changes here.

To those who want to go deeper, we will start our journey from the prover's perspective and follow his steps to create a valid FCMP++ proof. So the next step would be explaining how SAL works.